Skip to content

ROCO privacy policy

Effective 9 November 2026

This policy explains how personal data is handled when you use ROCO: the mobile app “ROCO by Mappalink” and the ROCO web app.

1. Who we are

ROCO is made by Mappalink BV, Blandenstraat 210, 3053 Oud-Heverlee, Belgium, VAT BE 0791.752.897, RPR Leuven (“Mappalink”, “we”). The app is published on the App Store by Quincy Roco BV on behalf of Mappalink BV.

Contact for privacy questions: [email protected].

2. Your organisation decides, we process

ROCO is a business service. You have an account because your employer, or the site you work for, uses ROCO to run autonomous robots and vehicles.

  • Your organisation is the controller. It decides who gets an account, which site you see, and what ROCO is used for.
  • Mappalink is the processor. We process personal data on your organisation’s behalf and on its documented instructions, under a data processing agreement (article 28 GDPR) that is part of our contract.

We act as controller ourselves only for:

  • keeping the service secure (sign-in records, security logs);
  • answering support questions you send us directly;
  • meeting legal obligations.

3. What we collect

Your account

  • Name, work email address, role and the sites you have access to. Your organisation gives us these when it creates your account; without them you cannot sign in.
  • Sign-in data: when you signed in, and the session that keeps you signed in. Passwords are stored only as a hash.

What you do in ROCO

  • Things you create or change: tickets, notes, comments, settings and pins. These carry your name and the time.
  • In the web app, which pages and views you open, so we can see which parts of ROCO are used. The mobile app does not send this.

Your device (mobile app)

  • When you allow notifications: a push token, the platform (iOS or Android) and your phone’s name, so ROCO can send you alerts and you can tell your devices apart.
  • Your session is stored in the phone’s secure storage, not on our servers.

Operational data that can relate to people ROCO’s main data is about robots, vehicles, orders and the site: positions, states, alerts and reports. Some of it can relate to people, such as the names on a shift rota or who handled an intervention. Leaderboards show operators by a nickname, not by their name. Your organisation decides what is connected.

What we do not collect No location of your phone, no contacts, photos, camera or microphone, no advertising identifiers. The app contains no advertising or third-party analytics SDKs. We do not track you across apps or websites, and we do not sell personal data.

Crash reports If you have allowed it in your phone’s settings, Apple shares crash reports with us. They contain no name or email address.

4. Why, and on what basis

Purpose Legal basis
Providing ROCO to your organisation: sign-in, showing your site, alerts, tickets Your organisation’s instructions (art. 28 GDPR); its own basis is usually its legitimate interest in running the site, or your employment contract
Push notifications Your organisation’s instructions, and your permission on the phone, which you can withdraw in Settings at any time
Security, abuse prevention, troubleshooting Our legitimate interest in a secure service (art. 6(1)(f))
Improving ROCO from usage of its features Our contract with your organisation; we use the result only in aggregated or anonymised form
Answering support questions Our legitimate interest in helping you (art. 6(1)(f))
Legal obligations (accounting, authority requests) Legal obligation (art. 6(1)(c))

5. AI in ROCO

Some ROCO features use AI: the assistant that answers questions about your site, and texts such as summaries, highlights and suggested actions. In line with the EU AI Act (Regulation (EU) 2024/1689):

  • You know when it is AI. The assistant is an AI system. Summaries, highlights, suggested actions and report texts can be written by it.
  • What it is for. The AI explains how robots and the site perform. On a leaderboard it can summarise the figures, which show operators by nickname. It does not decide anything about people.
  • A person decides. Suggestions are advice; nothing happens to a robot or a person automatically because the AI said so. There is no automated decision-making with legal or similarly significant effects (art. 22 GDPR).
  • Which models. Your questions, and the site data the AI needs for an answer or a summary, are sent to a language-model provider (section 6). Its contract forbids it to use them to train or fine-tune any model. Don’t type personal data into the assistant unless the question needs it.

6. Who receives data

Only people at your organisation with access to your site, Mappalink staff who run and support the service, and the service providers we use for:

  • hosting and backups, in Germany;
  • accounts and sign-in, in Sweden;
  • sending email, in Germany;
  • delivering push notifications to your phone, in the United States;
  • the language model behind the AI features, in the United States.

Transfers to the United States are covered by the European Commission’s standard contractual clauses or the EU-U.S. Data Privacy Framework. The providers by name, and a copy of the safeguards, are available on request.

7. How long

  • Account data: as long as your account exists. When your organisation closes your account you can no longer sign in; we delete the account on request, and in any case after your organisation’s contract ends and its export period has passed.
  • Things you created (tickets, notes, comments): kept with your site’s data, for the retention in your organisation’s contract (one year on standard hosting, three with high availability).
  • Push token: until you sign out, turn off notifications, or the token stops working.
  • Security logs: 90 days.
  • Backups: rolled over within 4 weeks.

8. Security

Encryption on every connection (HTTPS/TLS), a separate environment per site, access limited to the site a person works at, named staff accounts with personal keys, nightly backups that are checked daily, and monitoring around the clock. Mappalink notifies your organisation of a personal data breach without undue delay, where possible within 48 hours.

9. Your rights

Under the GDPR you have the right to access your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format.

  • For data processed for your organisation, the quickest route is your organisation’s ROCO administrator. You can also write to us; we pass the request on and help your organisation answer it.
  • Closing your account: your administrator closes it, or you ask us at [email protected] to delete it. Accounts are created by your organisation, not in the app.
  • You can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, www.dataprotectionauthority.be) or the authority where you live or work.

10. Children

ROCO is a tool for work and is not meant for people under 16.

11. Changes

We update this policy when ROCO or the law changes. The date at the top shows the current version; for material changes we inform your organisation in advance.